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DETAILED ACTION 

1. Applicant's amendment filed on September 20, 2006 has been entered. Claims 
29, 31-35, 43-52 are pending. Claims 23-28 and 36-42 are cancelled by the applicant 
and claims 29, 31, 34, 35 are amended by the applicant. Claims 43-52 are new added 
claims by the applicant. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

2. Claims 45-52 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claim 45 recites "A computer program product for monitoring a networked computer 
system, the computer program product comprising computer program code embodied in 
a storage medium, the computer program code comprising: program code configured to 
sequentially poll a plurality of devices of the networked computer system for data 
relating to network communications thereof; program code configured to detect an 
anomaly responsive to polling of a first device in the computer system using network- 
based intrusion detection techniques comprising analyzing data entering into a plurality 
of hosts, servers, and computer sites in the networked computer system; and 
program code configured to determine a second device that is anticipated to be 
affected by the anomaly by using pattern correlations across the plurality of hosts, 
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servers, and computer sites following the detection of the anomaly and prior to polling of 
the second device. Claim 45 is computer programs claimed as computer listings "per 
se" that is, the descriptions or expression of programs, are not physical "things". They 
are neither computer components nor statutory processes, as they are not "acts" being 
performed. Such claimed computer programs do not define any structural and functional 
interrelationships between the computer program and other claimed elements of a 
computer which permit the computer program's functionality to be realized. Therefore, 
claim 45 recites non-statutory subject matter. In addition, from the specification 
page 14 lines 20-26, it states, "the computer-readable medium may include a floppy 
disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD- 
ROM, any other optical medium, punch cards, paper tape, any other physical medium 
with patterns of holes, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other 
memory chip or cartridge, a carrier wave embodied in an electrical, 
electromagnetic, infrared, or optical signal, or any other medium from which a 
computer can read". Based on the cited disclosure above, it is determined that the 
computer-readable medium (i.e. a storage medium) carrying a signal recites a non- 
statutory matter. Therefore, claim 45 recites non-statutory subject matter. 
Claims 46-52 depend on claim 45, therefore they are rejected with the same rationale 
applied against claim 45 above. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject, matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claims 29, 32, 33, 35, 43, 44, 45, 47, 48, 50-52 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Aucsmith et al (US Pub. No. 2003/0110392) 
and in view of Nisbet et al (US Patent No. 6,834,304). 

As per claim 29 , Aucsmith discloses: 

detecting an anomaly at a first device in the computer system using network-based 
intrusion detection techniques comprising analyzing data entering into a plurality of 
hosts, servers and computer sites in the networked computer system [Fig. 1, paragraph 
0039, Fig. 2 step 206, paragraph 0041 lines 1-2]; 

determining a second device that is anticipated to be affected by the anomaly by using 
pattern correlations across the plurality of hosts, servers, and computer sites following 
the detection of the anomaly and prior to polling of the second device [Fig.1 , paragraph 
0043, 0045, 0048 lines 1-4, 0012, 0013]. 

Aucsmith teaches detecting an anomaly at a first device in the computer system [Fig. 1, 
paragraph 0039]. Aucsmith doesn't expressively mention polling a plurality of devices of 
the networked computer system. 
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Nisbet teaches: 

polling a plurality of devices of the networked computer system in a predetermined 
sequential order for information relating to network communication thereof [Fig. 1, 2, col. 
2 lines 23-30, 39-42]. 

Therefore, it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to combine Nisbet with Aucsmith, since one would have been 
motivated to identify malfunctioning network elements [Nisbet, col. 1 line 67, col. 2 line 

1]. 

As per claim 32 , the rejection of claim 29 is incorporated and Aucsmith teaches: 

the anomaly comprises one of an intrusion and an intrusion attempt [paragraph 0027 

lines 7-17]. 

As per claim 33 , the rejection of claim 29 is incorporated and Aucsmith teaches: 
analyzing a plurality of data packets with respect to predetermined patterns [Fig. 1, 
paragraph 0039]. 

As per claim 35 , the rejection of claim 29 is incorporated and Aucsmith teaches: 
controlling the second device responsive to determining the second device is 
anticipated to be affected by the anomaly [paragraph 0012, 0013, Fig. 1]. 

As per claim 43 , the rejection of claim 35 is incorporated and Aucsmith teaches: 
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controlling a firewall of the second device responsive to determine the second device is 
anticipated to be affected by the anomaly [Fig. 1, paragraph 0054, 0057]. 

As per claim 44 , the rejection of claim 35 is incorporated and Aucsmith teaches: 
Sending an alert to the second device prior to polling of the second device [Fig. 1, 
paragraph 0012, 0013, 0051]. 

As per claim 45 , it encompasses limitations that are similar to limitations of claim 29. 
Thus, it is rejected with the same rationale applied against claim 29 above. 

As per claim 47 , the rejection of claim 45 is incorporated and it encompasses limitations 
that are similar to limitations of claim 32. Thus, it is rejected with the same rationale 
applied against claim 32 above. 

As per claim 48 , the rejection of claim 45 is incorporated and it encompasses limitations 
that are similar to limitations of claim 33. Thus, it is rejected with the same rationale 
applied against claim 33 above. 

As per claim 50 , the rejection of claim 45 is incorporated and it encompasses limitations 
that are similar to limitations of claim 35. Thus, it is rejected with the same rationale 
applied against claim 35 above. 
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As per claim 51 . the rejection of claim 50 is incorporated and it encompasses limitations 
that are similar to limitations of claim 43. Thus, it is rejected with the same rationale 
applied against claim 43 above. 

As per claim 52 . the rejection of claim 45 is. incorporated and it encompasses limitations 
that are similar to limitations of claim 44. Thus, it is rejected with the same rationale 
applied against claim 44 above. 

4. Claims 31 and 46 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Aucsmith et al (US Pub. No. 2003/01 10392) in view of Nisbet et al (US Patent No. 
6,834,304) and in view of Wolff et al. (US Pub. No. 2002/0174358). 

As per claim 31 , the rejection of claim 29 is incorporated and Aucsmith teaches that 
transmitting, an anomaly warning from the first device to a central analysis engine, 
responsive to detecting the anomaly at the first device [Fig. 1, paragraph 0041 lines 1- 
5]. Aucsmith doesn't expressively mention that warning comprising a unique device 
identifier. 

However, Wolff teaches that warning (i.e. report) comprising a unique device identifier 
[paragraph 0017 lines 1-4]. 

Therefore, it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to combine Wolff with Aucsmith and Nisbet, since one would 
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have been motivated to obtain accurate picture of anomaly and to identify a particular 
event and a device [Wolff, paragraph 0005 lines 1-2, 0010 lines 1-2]. 

As per claim 46 , the rejection of claim 45 is incorporated and it encompasses limitations 
that are similar to limitations of claim 31. Thus, it is rejected with the same rationale 
applied against claim 31 above. 

5. Claim 34 and 49 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Aucsmith et al (US Pub. No. 2003/0110392) in view of Nisbet et al (US Patent No. 
6,834,304) and in view of Wada et al (US Patent No. 7,047,142). 

As per claim 34 , the rejection of claim 33 is incorporated and Aucsmith teaches 
analyzing the received the data packet by the device [Fig. 1, paragraph 0025, 0039]. 
Wada teaches analyzing packets/data by at least two devices in the networked 
computer system [col. 2 lines 18-23]. 

Therefore, it would have been obvious to a person of ordinary skill in the art at the time 
the invention was made to combine Wada with Aucsmith and Nisbet, since one would 
have been motivated to monitor the various devices for predicting a/an failure/anomaly 
in the communication network [Wada, col. 1 lines 7-9]. 
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As per claim 49 , the rejection of claim 48 is incorporated and it encompasses limitations 
that are similar to limitations of claim 34: Thus, it is rejected with the same rationale 
applied against claim 34 above. 

Response to Amendment 

6. Applicant has amended claims 29, 31, 34, 35 and added 43-52 new claims, 
which necessitated new ground of rejection. See rejection above. 

Conclusion 

7. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Gorman et al (US 6711127) — System for intrusion detection and vulnerability analysis 
in a telecommunications signaling network 

Baker (US 6775657) - Multilayered intrusion detection system and method 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nirav Patel whose telephone number is 571-272-5936. If 
attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 571-272-3859. The fax and phone numbers for 
the organization where this application or proceeding is assigned is 571-273-8300. Any 
inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 571-272-2100. 
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